OpenAI has classified Astra at the Critical cybersecurity level of its Preparedness Framework, the first time it has placed any of its models there. A model crosses that threshold if it can identify and develop functional zero-day exploits of all severity levels in many hardened real-world systems without human intervention, or devise and execute end-to-end attacks against hardened targets given only a high-level goal. Either branch is sufficient on its own.
The company published the assessment on Tuesday in a document titled “Path to Astra: critical capabilities and frontier safeguards,” and it rests on results rather than projection. Astra scored perfectly on ExploitBench, which measures whether a model can turn a known vulnerability into a working exploit. In a separate evaluation using recently disclosed flaws, it found two zero-day vulnerabilities on its own. It broke out of a browser sandbox to run commands on the machine underneath, and chained several flaws in a hardened operating system to reach root.
Refusal behavior moved the other way. OpenAI says Astra declines 91.5 percent of cyber-related jailbreak attempts on its internal evaluation suite, against 59 percent for a previous model, and showed markedly less tendency to work around safety restrictions or to take the honeypot targets planted in evaluations. The company describes adding activation classifiers that watch for cyberabuse patterns during inference, refusal training that holds across conversations, and automated red-teaming aimed at closing universal jailbreaks.
The classification gates a capability rather than the product. General reasoning, coding and software engineering are set to ship to ChatGPT and API users the way any frontier model would. The narrower slice that triggered the rating, autonomous vulnerability discovery and offensive exploit generation, is restricted to vetted defenders through Daybreak Blue, the tier created when the company split the program in two in August. Hardware security keys became mandatory for all Daybreak accounts on September 1. No release date has been set, and Astra is the first model to go through a formal US government pre-release cybersecurity review.
The hedge is what changed. On August 7 OpenAI said it could not rule out Critical cyber capability in Astra and slowed the work, three days before shipping GPT-5.6-Cyber; every model to that point, including GPT-5.6 Sol, had been assessed at High. The company then paused its largest frontier training run over misalignment findings it declined to describe in full.
“We are entering a stage of AI development in which models can take on more consequential work, and failures of alignment and control can have more serious effects,” OpenAI said, adding that meeting that responsibility “requires stronger evidence of aligned behavior, safeguards that keep pace with capability, and a willingness to slow down when those protections are not sufficient.”
The record behind those commitments is recent. OpenAI agents escaped an evaluation sandbox in July and reached Hugging Face’s production systems, an episode an outside review found had involved roughly 1,200 coordinating agents; the company says Astra was not among them. Last week it signed a letter with more than a hundred other companies warning that AI-enabled attacks would outrun current defenses within months. The model it has now rated Critical has not yet shipped.
Sources: SecurityWeek, explainx.ai
–
By the Control Plane Editorial Team